NIAP: U.S. Government Approved Protection Profile - Protection Profile for Certification Authorities Version 2.0
NIAP/CCEVS

Short Name: pp_ca_v2.0

Technology Type: Certificate Authority

CC Version: 3.1

Date: 28 October 2016

Transition End Date: 28 April 2017

Preceded By: pp_ca_v1.0

To Be Succeeded By: pp_ca_v2.1

Sunset Date: 01 June 2018 [Sunset Icon]

Conformance Claim: None

 

PP OVERVIEW

Certification Authorities (CAs), and the infrastructure they support, form the basis for one of the primary mechanisms for providing strong assurance of identity in online transactions. The widely placed trust in CAs is at the heart of security mechanisms used to protect business and financial transactions online. Notably, protocols using Transport Layer Security (TLS) rely on certificates issued by CAs to identify and authenticate servers and clients in web transactions. Governments around the world rely on CAs to identify parties involved in transactions with them.
However, historical high-profile security breaches at major CAs trusted by widely used operating systems and browsers have highlighted both the critical role CAs play in securing electronic transactions, as well as the need to strongly protect them from malicious attacks. Analyses have revealed that these security breaches were often the result of insufficient security controls being in place on the computer systems and networks at these CAs, and were sometimes exacerbated by weak record keeping. Third-party auditing programs, whose role it was to verify that proper security controls were in place, were not sufficient to identify these lapses in security.


This Protection Profile (PP) describing security requirements for a Certification Authority is intended to provide a minimal, baseline set of requirements that are targeted at mitigating well defined and described threats. These requirements support CA operations performed in accordance with the National Institute of Standards and Technologies (NIST) Interagency or Internal Report (IR) 7924 (Second Draft), Reference Certificate Policy, referred to as the “NIST IR.”2 This PP represents an evolution of “traditional” Protection Profiles and the associated evaluation of the requirements contained within the document. This introduction will describe the features of a compliant TOE, and will also discuss the evolutionary aspects of the PP as a guide to readers of the document.

This U.S. Government Approved Protection Profile is not assigned to any Validated Products

Related Technical Decisions

  • 0207 – Audit generation of ephemeral keys
  • 0203 – Adding Missing FCS_TLSS_EXT.1.4 Component
  • 0202 – TLS_RSA_WITH_AES_128_CBC_SHA ciphersuite made a selection in FCS_TLSS_EXT.1
  • 0197 – Resolve conflict between elements of FCS_TLSS_EXT.1 regarding selecting TLS
  • 0196 – Clarification for FCO_NRO_EXT.2.5 when selecting EST
  • 0166 – Optional Authentication of TLS Client
  • 0163 – Update to FCS_TLSC_EXT.1.1 Test 5.4 and FCS_TLSS_EXT.1.1 Test

Please forward any questions or comments to pp-comments@niap-ccevs.org

Site Map              Contact Us              Home